diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..bfb22b7
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,66 @@
+# Copyright (C) 2024 Daniel Mueller <deso@posteo.net>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+name: Publish
+
+on:
+  workflow_dispatch:
+
+jobs:
+  version:
+    name: Retrieve version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+    - uses: actions/checkout@v4
+    - id: version
+      shell: bash
+      run: |
+        cargo generate-lockfile
+        pkgid="$(cargo pkgid)"
+        # Format is typically
+        #   file://<path>/<crate>#<version>
+        # but could also be along the lines of
+        #   file://<path>/<crate>#<actual-crate-name>@<version>
+        version="$(echo ${pkgid} | cut -d '#' -f2 | cut -d '@' -f2 | grep -o '[^:]*$')"
+        if [ -z "${version}" ]; then
+          echo "Invalid version string: ${pkgid}"
+          exit 1
+        fi
+        echo "Determined crate version: ${version}"
+        echo "version=${version}" >> $GITHUB_OUTPUT
+  test:
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+  publish:
+    needs: [test, version]
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: dtolnay/rust-toolchain@stable
+    - name: Dry-run package creation
+      run: cargo package --no-verify
+    - name: Create git tag
+      env:
+        version: ${{ needs.version.outputs.version }}
+      run: |
+        curl --location \
+          --fail-with-body \
+          --request POST \
+          --url https://api.github.com/repos/${{ github.repository }}/releases \
+          --header "Accept: application/vnd.github+json" \
+          --header "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          --header "X-GitHub-Api-Version: 2022-11-28" \
+          --data "{
+              \"tag_name\":\"v${version}\",
+              \"target_commitish\":\"${{ github.ref }}\",
+              \"name\":\"v${version}\",
+              \"draft\":false,
+              \"prerelease\":false,
+              \"generate_release_notes\":false
+            }"
+    - name: Publish
+      run: cargo publish --no-verify --token "${CARGO_REGISTRY_TOKEN}"
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5dfc58b..00338e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,7 @@ name: Test
 on:
   pull_request:
   push:
+  workflow_call:
 
 env:
   CARGO_TERM_COLOR: always